We evaluate the performance of our obfuscation tool on a series of standard models [1]}, [2]}, [3]}. Specifically, we select VGG-11, VGG-13, ResNet-20, ResNet-32 models on CIFAR-10 running on a Turing GPU (GTX-1660). We select VGG-19, ResNet-18 and MobileNet-V2 models on ImageNet running on an Ampere GPU (RTX-3090).
For the GA, we set the population size to be 16 and run it till the fitness score stabilizes which occurs around 20 generations. The standard deviation \(\sigma \)  for the the mutation step is set to a high value (i.e. \(\sigma = 8.0\) ) at the beginning and gets halved after every 4 generations.
To eliminate the randomness, for each data point reported here, we choose the average of 3 runs.
